Change ossec(wazuh) agent profiles via saltstack

Question

I'm trying to modify the <config-profile> section of a ossc.conf file, including a grains content.

something like:

ossec-profiles:
  - profile1
  - profile2

and I want to modify the section <config-profile> from

<config-profile>centos, centos7</config-profile>

to

<config-profile>centos, centos7, profile1, profile2</config-profile>

in the ossec.conf file

Any idea?

Answer 1

This can be done by using file.replace module which makes you able to change a text in a file based on a pattern. So in your case you can do the following:

You need to select the pattern as regex group so you can use it later as shown below

configure_ossec:
  file.replace:
    - name: /path/to/ossec.conf
    - pattern: '((<config-profile>.*?)[^<]*)'
    - repl: {{ '\\1, ' +  pillar['ossec-profiles'] | join(', ') }}

Or you might use this pattern to match only whatever inside config-profile tags then you will be able to call it again in the repl parameter:

(?<=<config-profile>)(.*)(?=<\/config-profile>)

Note: As pillar['ossec-profiles'] should return a list of profiles then you have to use the join filter in order to separate the values with comma as a delimiter

And finally the output expected to be something like this:

     Changes:   
              ----------
              diff:
                  --- 
                  +++ 
                  @@ -1 +1 @@
                  -<config-profile>centos, centos7</config-profile>
                  +<config-profile>centos, centos7, profile1, profile2</config-profile>